BIT-jre-2025-0509

vendorUSosv

Signing Checks Bypass

view advisory published 2026-05-08Licence: per source

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-0509US	medium6.8	0.90% (60th)	—	2025-02-04
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

references

External citations — patches, advisories, analysis.

https://github.com/sparkle-project/Sparkle/pull/2550FIX
https://nvd.nist.gov/vuln/detail/CVE-2025-0509WEB
https://security.netapp.com/advisory/ntap-20250124-0008/ADVISORY
https://sparkle-project.org/documentation/security-and-reliability/FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan